CVE-2026-23255: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23255 is a race condition vulnerability in the Linux kernel's /proc/net/ptype interface caused by improper RCU (Read-Copy-Update) synchronization in the ptype_seq_next() and ptype_seq_show() functions. It affects Linux kernel versions from 2.6.12 through 6.6.136, 6.7 through 6.12.80, and 6.13 through 6.18.10, as well as release candidates up to 6.19-rc8. The vulnerability was reported by Yin Fengwei (with a reproducer provided by Dong Chenchen) and disclosed on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per Red Hat, though some sources assess it as high severity (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a concurrent access race condition (CWE-362) in the Linux kernel's /proc/net/ptype sequential file interface. ptype_seq_show() executes under rcu_read_lock() and reads pt->dev (a device pointer) without a memory barrier, while concurrent writers can remove a packet_type structure and clear pt->dev without observing an RCU grace period — creating a use-after-free or stale pointer dereference scenario. Additionally, ptype_seq_next() is missing READ_ONCE() barriers when traversing list.next values, further violating RCU rules. The fix introduces a ptype_iter_state structure that carries a stable dev pointer through the iteration state, records it in ptype_get_idx() and ptype_seq_next(), and adds proper READ_ONCE() barriers (Red Hat Bugzilla, Red Hat Advisory).

A local attacker with low privileges can exploit this race condition to trigger RCU stalls that freeze kernel execution (denial of service), read uninitialized or freed memory to leak sensitive kernel information (information disclosure), or cause kernel panics through use-after-free conditions (integrity violation). The vulnerability is confined to the local system and does not provide a direct path for remote exploitation or lateral movement, but kernel-level memory disclosure could facilitate privilege escalation in chained attack scenarios (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing RCU stall warnings such as INFO: rcu_sched detected stalls or rcu_preempt self-detected stall associated with ptype_seq_show or ptype_seq_next stack frames.
• Logs: Kernel oops or BUG messages referencing use-after-free or null pointer dereference in net/core/dev.c or ptype_seq_* functions.
• Process: Unusual or repeated access to /proc/net/ptype by low-privileged processes, particularly in tight loops or concurrent with network interface changes.
• System Behavior: Unexpected kernel freezes, hangs, or reboots on systems with active network packet type manipulation.

Apply kernel patches that include the fix: upstream commits 589a530ae44d0c80f523fcfd1a15af8087f27d35 and f613e8b4afea0cd17c7168e8b00e25bc8d33175d (and related stable backports 002a73470b56848e4c81efeaaedd471e92d66d8d, dcefd3f0b9ed8288654c75254bdcee8e1085e861). Fixed versions include Linux kernel 6.6.136+, 6.12.80+, 6.18.10+, and 6.19+; distribution-specific fixes are available via SUSE (SUSE-SU-2026:1661-1), Debian (DSA-6238-1, linux 6.12.85), and Amazon Linux 2023 (ALAS2023-2026-1646). As a workaround where patching is not immediately possible, restrict local user access to /proc/net/ptype using SELinux or AppArmor policies, and limit the ability of unprivileged users to manipulate network packet type structures (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was initially reported by Yin Fengwei with a patch, and a reproducer was provided by Dong Chenchen, both credited in the upstream kernel commit message. Red Hat triaged the issue at medium severity and opened a public Bugzilla entry on March 18, 2026. Distribution vendors including SUSE, Debian, and Amazon Linux have issued security advisories and updated packages. No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability tracking channels (Red Hat Bugzilla, Red Hat Advisory).